Should I vibe code
Email marketing platform with campaigns, automations, forms, and analytics
Sending bulk email is 5% code and 95% not getting your domain blacklisted forever.
?
Their verdict, the Standard price and the build-time estimate come from their entry, MIT-licensed. Checked 2026-08-03.
?
Our verdict, the regret score and everything below it. Editorial and unsponsored — nobody can pay to be moved.
The honest answer
why the verdict is what it is
The send loop takes an hour. Deliverability, unsubscribe handling, bounce and complaint processing, and the legal minimum for commercial mail take considerably longer, and getting them wrong burns a domain you cannot un-burn.
What actually breaks
not "if". the specific failures.
- Your sending domain, permanently, after one bad list
- Unsubscribes that silently fail, which is the specific thing the law cares about
- Bounce handling — keep mailing dead addresses and providers stop trusting you
- A retry loop that resends the whole campaign
- Every future email from your domain, including the transactional ones you needed to work
The campaign went out twice. You know because the replies are arriving. Somewhere in the retry logic a timeout was treated as a failure, and eleven thousand people now have two copies of an email they were lukewarm about the first time. The complaint rate crosses a threshold you did not know existed. Two days later your password reset emails stop arriving for everyone, and the fix is a support ticket to a provider who has no reason to prioritise you.
Is that you?
the verdict is a default, not a law
- You are sending through an established provider’s API and only building the composer and list UI
- The list is small, opted-in, and yours
- Unsubscribe is a single click with no login, and it is the first thing you built
- You are running your own SMTP or managing your own sending IPs
- The list came from anywhere other than people explicitly asking
- Your transactional email shares a domain with this
If you build it anyway
the checklist, then the prompt that enforces it
- Never send from your primary domain. Use a subdomain so a reputation fire does not take your business email with it.
- Use a sending API — Postmark, SES, Resend — and let them own deliverability. You are building the composer, not the sender.
- One-click unsubscribe, working, before the first send. Honour it within the legal window, not eventually.
- Process bounce and complaint webhooks and suppress automatically. A suppression list is not optional.
- Make sends idempotent with a per-recipient per-campaign key, so a retry can never double-send.
- Log consent: when, how, and from what IP each address opted in.
I am building a newsletter tool. Before writing code, enforce these: 1. I am NOT running my own SMTP. Use a sending API (Postmark, SES or Resend) via their SDK. If I ask you to send mail directly over SMTP, refuse and explain deliverability. 2. Sends go from a subdomain (mail.example.com), never the apex. Set up SPF, DKIM and DMARC and give me the exact DNS records as a checklist. 3. Build in this order and do not reorder it: a. subscriber storage with consent metadata (timestamp, source, IP) b. one-click unsubscribe, no login required, honoured immediately c. suppression list d. bounce + complaint webhook handlers that write to the suppression list e. only then, the composer and the send loop 4. Every send is idempotent. Key on (campaign_id, subscriber_id) in a sent table, checked before dispatch, written in the same transaction. 5. Rate-limit the send loop and make it resumable. A crash mid-campaign must resume, never restart. 6. Add a hard 'dry run' mode that renders and logs but sends nothing, and make it the default. 7. Include the legally required physical address and unsubscribe link in the template itself, so no campaign can omit them. 8. Write a README section listing what I am legally responsible for under CAN-SPAM and GDPR. Do not tell me it is handled — tell me it is mine. 9. Out of scope: IP warm-up, dedicated IPs, engagement-based segmentation. Those are why ESPs cost money.
That one keeps you out of trouble. For the prompt that actually builds it, canivibecodeit.com has one.
their build prompt ↗Or don’t build it
the boring option, and the way back out
Almost always. $20 a month buys you deliverability engineering, compliance defaults and someone else’s reputation to send from. The one honest DIY case is the composer and archive on your own site, with sending delegated to an API.
$20/mo is cheaper than your weekend.
Keep subscribers, consent records and suppression in a plain exportable table from day one. Migrating to a real ESP should be a CSV import, and the suppression list is the part you must not lose — re-mailing people who unsubscribed is the fastest way to turn a technical problem into a legal one.
Open-source marketing automation platform with email campaigns and contact management.
Questions
Surely sending email is just SMTP?
Sending is SMTP. Arriving is not. Between the two sit authentication records, sender reputation, engagement signals and spam filters that will silently drop your mail with no error for you to catch.
What is the safe version of this project?
Own the list, the composer and the archive. Delegate the actual sending to a provider. You get the parts that are fun and yours, and skip the part that can burn a domain.
- CAN-SPAM Act: A Compliance Guide for Business (FTC)
- GDPR Art. 7 — conditions for consent (EU)
Every week, someone ships something they shouldn’t have.
New verdicts, the worst thing that landed in the trap, and the occasional incident report. No other email, ever.
Paid memberships mean people are owed access. Access has to survive your enthusiasm.
Your reputation as a sender is an asset you can destroy in one bad loop and never rebuild.
Lifecycle email means automated messages you did not personally read going to real customers.
last reviewed 2026-08-03 · verdict is editorial and unsponsored · shared entry data from canivibecodeit under MIT · not legal advice